Analysis
- max time kernel
105s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
02/11/2024, 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
- Target 1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe
- Size 4.3MB
- Sample241102-vtbbxazmfz
- SHA256 1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90c
- MD5 f9e65879591b386777963d831c973160
- SHA1 9e4ebde3a4f0dd93e5c1686cc88f628cfb80adc5
- SHA512 39a0da94989e3177f88012b010ad9bf6cc79f8cdcf753a780765e78c13ec26b07cc6563e8296c7d8bf3b2968363c87c3356c067d54685653e362d39e627b7dc5
- SSDEEP 24576:9jJ8gkE2fh4Coswkx2KdcPCl9AuDF5zUPGLG5SvAMZAMg9:998gkEaSPkx2KiPy9AuDzY
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 3640 sysx32.exe 5004 _1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\O: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\curl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe sysx32.exe File created C:\Windows\SysWOW64\mshta.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Robocopy.exe sysx32.exe File created C:\Windows\SysWOW64\sdbinst.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe sysx32.exe File created C:\Windows\SysWOW64\TSTheme.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\TapiUnattend.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\bthudtask.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\msdt.exe sysx32.exe File created C:\Windows\SysWOW64\shrpubw.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\waitfor.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\calc.exe sysx32.exe File created C:\Windows\SysWOW64\PickerHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\diskperf.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\logagent.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\openfiles.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wusa.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\fontdrvhost.exe sysx32.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Utilman.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Com\MigRegDB.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\clip.exe sysx32.exe File created C:\Windows\SysWOW64\mobsync.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\TokenBrokerCookies.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\net1.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\UserAccountBroker.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\OneDriveSetup.exe sysx32.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Taskmgr.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\PackagedCWALauncher.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\print.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\RmClient.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\xcopy.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\net1.exe sysx32.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\setupugc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\stordiag.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchWinApp.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.tmp sysx32.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.tmp sysx32.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe sysx32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe sysx32.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe.tmp sysx32.exe File created C:\Program Files\Windows Mail\wabmig.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe.tmp sysx32.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe sysx32.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe.tmp sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe.tmp sysx32.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe sysx32.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp sysx32.exe File created C:\Program Files\Windows Media Player\wmpshare.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15805.0_none_aadf84cda75da02d\aspnet_regsql.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.746_none_744cb37f06e446cc\RuntimeBroker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.19041.1_none_6e5126083c2c0ea6\NDKPing.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_1a55178fad503598\ttdinject.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.19041.1_none_3b97be772075a03a\RdpSa.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\r\wscadminui.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\vdsldr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c_axinstui.exe_eba3b15b sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\SearchProtocolHost.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.1_none_3d521dedd6c76700\hcsdiag.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorQuickStart.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\f\iexplore.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\f\msra.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-proquota_31bf3856ad364e35_10.0.19041.1_none_e80cafad6623705f\proquota.exe sysx32.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.1_none_04930b2bd1f9871f\Microsoft.AsyncTextService.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.19041.1_none_58ba966f5b8ade0b\dpnsvr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.19041.1_none_6bb9fe0edad453cc\omadmprc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\r\TSTheme.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.1151_none_d57e154a0a8460d3\f\pacjsworker.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.19041.1_none_3a8d8b0c2eae5eda\DpiScaling.exe.tmp sysx32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\InputPersonalization.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.1_none_623e57cb80e184b5\PasswordOnWakeSettingFlyout.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\usocoreworker.exe.tmp sysx32.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4_vds.exe_cb461c29.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.1151_none_d57e154a0a8460d3_pacjsworker.exe_6e8eaf33.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.1_none_9556bb9420781f39\sdbinst.exe.tmp sysx32.exe File created C:\Windows\Boot\PCAT\memtest.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\r\windeploy.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\splwow64.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\msra.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.746_none_03030718c597d891\f\sdclt.exe.tmp sysx32.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1202_none_a5b2e5b8b986fe3d_wininit.exe_7a527f28.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1_none_b3f1d9ff0e206c99\quickassist.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.1_none_c780234a16dfd399\TabTip.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.1266_none_adfc223229a335a6\MusNotifyIcon.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_76d2900542f0226c\r\BackgroundTransferHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.19041.1_none_60b99066bd2f6d16\fsavailux.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..appserver-licensing_31bf3856ad364e35_10.0.19041.1_none_5ca728f7dabaeefb\tlsbln.exe sysx32.exe File opened for modification C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_10.0.19041.1_none_3c6036d4b220f210\InstallUtil.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\ScriptRunner.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.1_none_da5b9e6604736fbe\IEChooser.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_4e5e653d48e95632\iexpress.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\WpcMon.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.789_none_e07abbe9902a4f60\r\Utilman.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.1_none_4721ab47285172c4\net1.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_22ccf50c942e2ac7\r\TokenBrokerCookies.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\r\oobeldr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1202_none_a391067a6b9b433c\r\appidtel.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1202_none_fceb29af5a61f7e6\f\bcdedit.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\winresume.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\f\cmproxyd.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.19041.1_none_81400e8a2cfebcbb\FirstLogonAnim.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\f\UpdateNotificationMgr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\r\msinfo32.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.1_none_760acfd88cf7390d\MuiUnattend.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_ce6643a69c39f80a\f\ThumbnailExtractionHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.19041.1_none_afd43cb1c2b70f77\wlanext.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.19041.1_none_b4528a0bdf7b6cee\SMSvcHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.1_none_ebe59bdc3d4ddc3f\FlashUtil_ActiveX.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 860 wrote to memory of 3640 860 1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe 84 PID 860 wrote to memory of 3640 860 1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe 84 PID 860 wrote to memory of 3640 860 1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe 84 PID 860 wrote to memory of 5004 860 1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe 85 PID 860 wrote to memory of 5004 860 1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe"C:\Users\Admin\AppData\Local\Temp\1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3640
-
-
C:\Users\Admin\AppData\Local\Temp\_1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exeC:\Users\Admin\AppData\Local\Temp\_1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe2⤵
- Executes dropped EXE
PID:5004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.3MB
- SHA256 16b6583833eccef5457dc7679ce45941c91e75166ece8f0574bdb9378679e67c
- MD5 08a26f2411d591221f4d91719e38329e
- SHA1 e3f4162827ed9930058a99a0c7b7d54a5dfc4052
- SHA512 68af7a99ca3d4d881c694994df677176e3c3ecd131d4b931bb134815b9b482a8532774c523dbc13ea15bce89304decf2aa35fb1c336712175752ec43133dbbe8
- SSDEEP 24576:9jz+gkE2fh4Coswkx2KdcPCl9AuDF5zUPGLG5SvAMZAMg9:9mgkEaSPkx2KiPy9AuDzY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90cN.exe
- Size 4.3MB
- SHA256 49156c134ff9fe02362061785c3f6faf7a9dd881a1dd999dab1bfbcef70341ac
- MD5 9433717b100fed8b1e41d9d3bdd5b162
- SHA1 87bc1574804f61e70bb4d8af09fa799f63b246da
- SHA512 91650c8c3d6861a14a25b8c2d795ed0e057a5c4f848aab80b71efd4ebb5cd73ca22f57ce2fecdc87d9c059f8b8699eef00eccdcab2da6b0e04fc2791d1a42387
- SSDEEP 24576:C8gkE2fh4Coswkx2KdcPCl9AuDF5zUPGLG5SvAMZAMg9:C8gkEaSPkx2KiPy9AuDzY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 4.3MB
- SHA256 1779543b5ac0f4456dafc3232712c1ad597fd8206ff833e9249cf03d34b2f90c
- MD5 f9e65879591b386777963d831c973160
- SHA1 9e4ebde3a4f0dd93e5c1686cc88f628cfb80adc5
- SHA512 39a0da94989e3177f88012b010ad9bf6cc79f8cdcf753a780765e78c13ec26b07cc6563e8296c7d8bf3b2968363c87c3356c067d54685653e362d39e627b7dc5
- SSDEEP 24576:9jJ8gkE2fh4Coswkx2KdcPCl9AuDF5zUPGLG5SvAMZAMg9:998gkEaSPkx2KiPy9AuDzY
- MD5 SHA1 SHA512 SSDEEP